What condition keys are supported for keys and credentials - Key Management Service

Condition keys control when a policy statement takes effect. Add them to key policies, credential policies, and Resource Access Management (RAM) custom policies to control access to KMS resources and operations.

Note

The Principal field in the policy examples is required for key policies and credential policies. If you use a RAM custom policy, omit this field.

Alibaba Cloud universal condition keys

acs:SourceIp

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:SourceIp	The public IP address of the client that sends the request	String	All KMS OpenAPI operations (API overview).	An IP address. Examples: `"126.34.XX.XX"` `"2001:0db8:85a3:0000:0000:8a2e:XXXX:XXXX"`	RAM custom policy Key policy Credential policy

RAM policy example

Allow the GenerateDataKey operation only from the 116.62.XX.XX/24 IP address range.

{
    "Statement": [
        {
            "Action": "kms:GenerateDataKey",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": "116.62.XX.XX/24"
                }
            }
        }
    ],
    "Version": "1"
}

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only from the IP address 203.0.XX.XX.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "203.0.XX.XX"
                    ]
                }
            }
        }
    ]
}

acs:SourceVpc

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:SourceVpc	VPC of the requesting client. Valid only for requests from an Alibaba Cloud VPC.	String	All KMS OpenAPI operations (API overview).	The ID of the VPC. Example:`vpc-bp1717bgs34gj****`	RAM custom policy Key policy Credential policy

Limits:

All actions in the Statement field of the policy must start with kms:, such as "Action":"kms:*" and "Action":"kms:GenerateDataKey". Values like "Action":"*" and "Action":"k*" are invalid.
Supported in specific regions only ().

Regions that support acs:SourceVpc

Public cloud

Region classification	Supported regions
China	China (Hangzhou), China (Shanghai), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), China (Hong Kong)
Other countries and regions	Malaysia (Kuala Lumpur), Japan (Tokyo), Germany (Frankfurt), US (Virginia), US (Silicon Valley), Indonesia (Jakarta), UK (London), Philippines (Manila), Singapore, South Korea (Seoul), Thailand (Bangkok)

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only from vpc-bp1l8j1t3l3j5****.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:SourceVpc": [
                        "vpc-bp1l8j1t3l3j5****"
                    ]
                }
            }
        }
    ]
}

acs:VpcSourceIp

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:VpcSourceIp	IP address of the requesting client. Valid only for requests from an Alibaba Cloud VPC.	String	All KMS OpenAPI operations (API overview).	An IP address in a VPC. Examples: `"126.34.XX.XX"` `"2001:0db8:85a3:0000:0000:8a2e:XXXX:XXXX"`	RAM custom policy Key policy Credential policy

Limits: Supported in specific regions only ()

Regions that support acs:VpcSourceIp

Region classification	Supported regions
China	China (Hangzhou), China (Shanghai), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), China (Hong Kong)
Other countries and regions	Malaysia (Kuala Lumpur), Japan (Tokyo), Germany (Frankfurt), US (Virginia), US (Silicon Valley), Indonesia (Jakarta), UK (London), Philippines (Manila), Singapore, South Korea (Seoul), Thailand (Bangkok)

Public cloud

RAM policy example

Allow the GenerateDataKey operation only from the 172.168.XX.XX/24 CIDR block in vpc-bp1717bghfnkqg5wn****.

{
    "Statement": [
        {
            "Action": "kms:GenerateDataKey",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:SourceVpc": "vpc-bp1717bghfnkqg5wn****"
                },
                "IpAddress": {
                    "acs:VpcSourceIp": "172.168.**.**/24"
                }
            }
        }
    ],
    "Version": "1"
}

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only from the VPC IP address 192.168.XX.XX.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "IpAddress": {
                    "acs:VpcSourceIp": [
                        "192.168.XX.XX"
                    ]
                }
            }
        }
    ]
}

acs:SecureTransport

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:SecureTransport	Whether the request uses HTTPS	Boolean	All KMS OpenAPI operations (API overview).	`true` `false`	RAM custom policy Key policy Credential policy

RAM policy example

Allow all KMS operations only when the request is sent over HTTPS.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "kms:*",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ]
}

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only over HTTPS.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ]
}

acs:CurrentTime

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:CurrentTime	The time when the server receives the request	Date and time	All KMS OpenAPI operations (API overview).	ISO 8601 timestamp in UTC. For example, 20:00:00 on January 10, 2024 (UTC+8) is expressed as`2024-01-10T20:00:00+08:00`or`2024-01-10T12:00:00Z`.	RAM custom policy Key policy Credential policy

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only before 2099-12-31T12:00:00Z.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2099-12-31T12:00:00Z"
                }
            }
        }
    ]
}

acs:MFAPresent

Condition key	Description	Condition operator type	API operations	Value range	Policy type
acs:MFAPresent	Whether MFA is used for logon	Boolean	All KMS OpenAPI operations (API overview).	`true` `false`	RAM custom policy Key policy Credential policy

Key/Credential policy example

Allow the RAM user ramuser1 to perform KMS operations only when MFA is enabled.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "kms policy",
            "Effect": "Allow",
            "Action": "kms:*",
            "Principal": {
                "RAM": [
                    "acs:ram::1192853035****:user/ramuser1"
                ]
            },
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "acs:MFAPresent": [
                        "true"
                    ]
                }
            }
        }
    ]
}

KMS condition keys (key-related)

kms:tag (keys)

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:tag (keys)	Filters access based on key tags	String	Encrypt Decrypt ReEncrypt ExportDataKey GenerateDataKey GenerateDataKeyWithoutPlaintext GenerateAndExportDataKey AsymmetricDecrypt AsymmetricEncrypt AsymmetricSign AsymmetricVerify GetPublicKey DescribeKey UpdateKeyDescription EnableKey DisableKey CancelKeyDeletion ScheduleKeyDeletion ImportKeyMaterial GetParametersForImport DeleteKeyMaterial CreateKeyVersion DescribeKeyVersion ListKeyVersions UpdateRotationPolicy SetDeletionProtection	A custom key tag	RAM custom policy Key policy Credential policy

kms:EncryptionAlgorithm

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:EncryptionAlgorithm	Filters access based on the encryption algorithm in the request	String	Decrypt Encrypt GenerateDataKey GenerateDataKeyWithoutPlaintext ReEncrypt AsymmetricDecrypt AsymmetricEncrypt ExportDataKey GenerateAndExportDataKey	An encryption algorithm, such as`SYMMETRIC_DEFAULT`,`RSAES_OAEP_SHA_256`, or`ECIES_DH_SHA_1_XOR_HMAC`.Key management types and key specifications.	RAM custom policy Key policy

Key policy example

Deny the RAM user key_ramuser1 from using any encryption algorithm other than SYMMETRIC_DEFAULT for encryption, decryption, or re-encryption.

{
    "Sid": "Allow only one encryption algorithm with this asymmetric KMS key",
    "Effect": "Deny",
    "Principal": {
        "RAM": [
            "acs:ram::119285303511****:user/key_ramuser1"
        ]
    },
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt"
    ],
    "Resource": "*",
    "Condition": {
        "StringNotEquals": {
            "kms:EncryptionAlgorithm": "SYMMETRIC_DEFAULT"
        }
    }
}

kms:EncryptionContext:${EncryptionContextKey}

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:EncryptionContext:${EncryptionContextKey}	Filters access based on encryption context key-value pairs in the request	String	Decrypt Encrypt GenerateDataKey GenerateDataKeyWithoutPlaintext ExportDataKey GenerateAndExportDataKey	A custom encryption context	RAM custom policy Key policy

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to perform the GenerateDataKey operation only when the value of Project in the encryption context is ProjectA.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": [
            "acs:ram::119285303511****:*"
        ]
    },
    "Action": "kms:GenerateDataKey",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:EncryptionContext:Project": "ProjectA"
        }
    }
}

kms:EncryptionContextKeys

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:EncryptionContextKeys	Filters access based on encryption context key names in the request. Checks only the key names, not the values.	Array of strings	Decrypt Encrypt GenerateDataKey GenerateDataKeyWithoutPlaintext ExportDataKey GenerateAndExportDataKey	A custom key name from an encryption context key-value pair	Key policy

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to perform the GenerateDataKey operation only when the encryption context contains a key named Project.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": [
            "acs:ram::119285303511****:*"
        ]
    },
    "Action": "kms:GenerateDataKey",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:EncryptionContextKeys": "Project"
        }
    }
}

kms:ExpirationModel

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:ExpirationModel	Filters access to the ImportKeyMaterial operation based on the`ExpirationModel`parameter in the request	String	ImportKeyMaterial	`KEY_MATERIAL_DOES_NOT_EXPIRE` (the key material does not expire) `KEY_MATERIAL_EXPIRES` (the key material expires)	RAM custom policy Key policy

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to import key material only when the expiration model is KEY_MATERIAL_DOES_NOT_EXPIRE.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": "acs:ram::119285303511****:*"
    },
    "Action": "kms:ImportKeyMaterial",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:ExpirationModel": "KEY_MATERIAL_DOES_NOT_EXPIRE"
        }
    }
}

kms:ValidTo

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:ValidTo	Filters access to the ImportKeyMaterial operation based on the`ValidTo`parameter in the request	Date	ImportKeyMaterial	UNIX timestamp format	RAM custom policy Key policy

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to import key material only before June 20, 2024.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": "acs:ram::119285303511****:*"
    },
    "Action": "kms:ImportKeyMaterial",
    "Resource": "*",
    "Condition": {
        "NumericLessThanEquals": {
            "kms:ValidTo": "1718841600"
        }
    }
}

kms:KeyOrigin

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:KeyOrigin	Filters access based on the`Origin`property of the KMS key created or used in the operation	String	All key-related OpenAPI operations (API overview).	`Aliyun_KMS` `EXTERNAL` `KmsInstance`	RAM custom policy Key policy

kms:KeySpec

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:KeySpec	Filters access based on the`KeySpec`property of the KMS key created or used in the operation	String	All key-related OpenAPI operations (API overview).	A key specification, such as`Aliyun_AES_256`or`RSA_2048`.Key management types and key specifications.	RAM custom policy Key policy

Key policy example

Allow all RAM users and RAM roles under the Alibaba Cloud account 119285303511**** to call the CreateKey operation only to create RSA keys.

{
    "Effect": "Allow",
    "Action": "kms:CreateKey",
    "Principal": {
        "RAM": "acs:ram::119285303511****:*"
    },
    "Resource": "*",
    "Condition": {
        "StringLike": {
            "kms:KeySpec": "RSA_*"
        }
    }
}

kms:KeyUsage

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:KeyUsage	Filters access based on the`KeyUsage`property of the KMS key created or used in the operation	String	All key-related OpenAPI operations (API overview).	`ENCRYPT_DECRYPT` (encryption and decryption) `SIGN_VERIFY` (signing and signature verification)	RAM custom policy Key policy

RAM policy example

Allow the CreateKey operation only when the key usage is ENCRYPT_DECRYPT.

{
    "Effect": "Allow",
    "Action": "kms:CreateKey",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:KeyUsage": "ENCRYPT_DECRYPT"
        }
    }
}

kms:ScheduleKeyDeletionPendingWindowInDays

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:ScheduleKeyDeletionPendingWindowInDays	Filters access to the ScheduleKeyDeletion operation based on the`PendingWindowInDays`parameter in the request	Number	ScheduleKeyDeletion	The scheduled deletion period of the key, in days	RAM custom policy Key policy

Key policy example

Deny all users and roles from performing the ScheduleKeyDeletion operation if the scheduled deletion period is 21 days or fewer.

{
    "Effect": "Deny",
    "Action": "kms:ScheduleKeyDeletion",
    "Principal": "*",
    "Resource": "*",
    "Condition": {
        "NumericLessThanEquals": {
            "kms:ScheduleKeyDeletionPendingWindowInDays": "21"
        }
    }
}

kms:SigningAlgorithm

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:SigningAlgorithm	Filters access to the AsymmetricSign and AsymmetricVerify operations based on the signing algorithm in the request	String	AsymmetricSign AsymmetricVerify	A signing algorithm, such as`RSA_PSS_SHA_256`or`ECDSA_SHA_256`.Key management types and key specifications.	RAM custom policy Key policy

kms:WrappingAlgorithm

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:WrappingAlgorithm	Filters access to the GetParametersForImport operation based on the`WrappingAlgorithm`parameter in the request	String	GetParametersForImport	A wrapping algorithm.Import symmetric key material,Import asymmetric key material.	RAM custom policy Key policy

kms:WrappingKeySpec

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:WrappingKeySpec	Filters access to the GetParametersForImport operation based on the`WrappingKeySpec`parameter in the request	String	GetParametersForImport	Wrapping public key type.Import symmetric key material,Import asymmetric key material.	RAM custom policy Key policy

kms:KmsInstanceId (keys)

Condition key

Description

Condition operator type

API operations

Value range

Policy type

kms:KmsInstanceId (keys)

Filters access based on the ID of the KMS instance associated with the request

String

Listed by category below.

ReEncrypt
Encrypt
Decrypt
GenerateDatakey
AsymmetricDecrypt
AsymmetricSign
AsymmetricEncrypt
AsymmetricVerify
GetPublicKey
CreateKey
updateKeyDescription
EnableKey
DisableKey
scheduleKeyDeletion
createAlias
updateAlias
deleteAlias
listAliasByKeyId
getParametersForImport
importKeyMaterial
deleteKeyMaterial
createKeyVersion
describeKeyVersion
listKeyVersions
TagResource
UnTagResource
ListResourceTags

Instance ID

RAM custom policy
Key policy

RAM custom policy example

Allow the CreateKey operation only on the specified KMS instance.

{
    "Effect": "Allow",
    "Action": "kms:CreateKey",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:KmsInstanceId": "kst-**"
        }
    }
}

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to decrypt data only on the specified KMS instance.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": "acs:ram::119285303511****:*"
    },
    "Action": "kms:Decrypt",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:KmsInstanceId": "kst-**"
        }
    }
}

kms:RecipientAttestation:PCR{N}

Condition key	Description	Condition operator type	API operations
kms:RecipientAttestation:PCR{N}	Filters access by enclave attestation values. Supported PCR registers: PCR8 (enclave runtime image), PCR9 (kernel and bootloader), PCR11 (application metrics).	String	GenerateDataKey Decrypt
kms:RecipientAttestation:PCR9	kernel and bootloader
kms:RecipientAttestation:PCR11	application metrics

RAM custom policy example

Allow the GenerateDataKey and Decrypt operations on a specific key only when the enclave attestation values match.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "acs:kms:cn-hangzhou:119******460:key/key-hzz******sg5",
            "Condition": {
                "StringEquals": {
                    "kms:RecipientAttestation:PCR8": "300705e44da926d8ec85bb7e840******710f303e22de0869a",
                    "kms:RecipientAttestation:PCR9": "b5753ad8242e1c3b8150caf7098f******440bef5401e02575",
                    "kms:RecipientAttestation:PCR11": "f9189a4331f1d4ba93d77672401******04a19be1b4d4a5de"
                }
            }
        }
    ]
}

Key policy example

Allow all RAM users under the Alibaba Cloud account 119*******460 to perform KMS operations only when the PCR8 attestation value matches.

{
    "Statement": [
        {
            "Action": [
                "kms:*"
            ],
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::119*******460:*"
                ]
            },
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringEquals": {
                    "kms:RecipientAttestation:PCR8": "f193c1e72c226a2212d4d8865964239******ca6f02f79ea85e91af"
                }
            },
            "Sid": "kms default key policy"
        }
    ],
    "Version": "1"
}

KMS condition keys (credential-related)

kms:tag (credentials)

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:tag (credentials)	Filters access based on credential tags	String	DescribeSecret GetSecretValue PutSecretValue UpdateSecret UpdateSecretVersionStage RestoreSecret ListSecretVersionIds RotateSecret UpdateSecretRotationPolicy DeleteSecret	A custom credential tag	RAM custom policy Credential policy Key policy

kms:SecretName

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:SecretName	Filters access based on the`SecretName`parameter in the request	String	All credential-related OpenAPI operations (API overview).	A custom credential name	RAM custom policy Credential policy

kms:EncryptionKeyId

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:EncryptionKeyId	Filters access based on the encryption key ID in the credential request	String	CreateSecret GetSecretValue PutSecretValue	Key ID	RAM custom policy Credential policy

kms:SecretVersionId

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:SecretVersionId	Filters access based on the credential version ID in the request	String	GetSecretValue PutSecretValue	The version number of the credential	RAM custom policy Credential policy

kms:SecretVersionStage

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:SecretVersionStage	Filters access based on the credential version stage in the request	String	GetSecretValue UpdateSecretVersionStage	`ACSCurrent` `ACSPrevious` or a custom credential version stage	RAM custom policy Credential policy

kms:SecretType

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:SecretType	Filters access based on the credential type in the request	String	All credential-related OpenAPI operations (API overview).	`Generic` (a generic secret) `Rds` (an RDS credential) `RAMCredentials` (a RAM credential) `ECS` (an ECS credential) `Redis` (a Redis credential)	RAM custom policy Credential policy

kms:ForceDeleteWithoutRecovery

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:ForceDeleteWithoutRecovery	Filters access based on the`ForceDeleteWithoutRecovery`parameter in the request	Boolean	DeleteSecret	`true` `false`	RAM custom policy Credential policy

kms:RecoveryWindowInDays

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:RecoveryWindowInDays	Filters access to the DeleteSecret operation based on the recovery window specified in the request	Number	DeleteSecret	Number of days	RAM custom policy Credential policy

Credential policy example

Deny all users and roles from performing the DeleteSecret operation if the recovery window is 10 days or fewer.

{
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "kms:DeleteSecret",
            "Principal": "*",
            "Resource": "*",
            "Condition": {
                "NumericLessThanEquals": {
                    "kms:RecoveryWindowInDays": "10"
                }
            }
        }
    ]
}

kms:KmsInstanceId (credentials)

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:KmsInstanceId (credentials)	Filters access based on the ID of the KMS instance associated with the request	String	CreateSecret DescribeSecret UpdateSecret ListSecretVersionIds RestoreSecret RotateSecret UpdateSecretRotationPolicy GetSecretValue PutSecretValue UpdateSecretVersionStage DeleteSecret	Instance ID	RAM custom policy Key policy

RAM custom policy example

Allow the CreateSecret operation only on the specified KMS instance.

{
    "Effect": "Allow",
    "Action": "kms:CreateSecret",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:KmsInstanceId": "kst-**"
        }
    }
}

Key policy example

Allow all RAM users under the Alibaba Cloud account 119285303511**** to create credentials only on the specified KMS instance.

{
    "Effect": "Allow",
    "Principal": {
        "RAM": "acs:ram::119285303511****:*"
    },
    "Action": "kms:CreateSecret",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:KmsInstanceId": "kst-**"
        }
    }
}

KMS condition keys (other)

kms:TlsVersion

Condition key	Description	Condition operator type	API operations	Value range	Policy type
kms:TlsVersion	Filters access based on the TLS version in the request	String	All OpenAPI operations that require authentication. Operations that do not require authentication, such asDescribeRegions, are excluded.	`1.2`	RAM custom policy Key policy Credential policy

RAM policy example

Deny any operation on the specified key if the TLS version is earlier than 1.2.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "kms:*",
            "Resource": "acs:kms:*:*:key/key-hzz653f1f8fybn5qa****",
            "Condition": {
                "NumericLessThan": {
                    "kms:TlsVersion": [
                        "1.2"
                    ]
                }
            }
        }
    ]
}

Appendix: Condition operator types

Condition operator types include String, Number, Date and time, Boolean, and IP address. For the meanings and examples of condition operators, see Condition operators.

Condition operator type	Supported type
String	StringEquals StringNotEquals StringEqualsIgnoreCase StringNotEqualsIgnoreCase StringLike StringNotLike
Number	NumericEquals NumericNotEquals NumericLessThan NumericLessThanEquals NumericGreaterThan NumericGreaterThanEquals
Date and time	DateEquals DateNotEquals DateLessThan DateLessThanEquals DateGreaterThan DateGreaterThanEquals
Boolean	Bool
IP address	IpAddress NotIpAddress